PSIRT bulletins, normalized

Bluetooth: hci_conn: fix CIS hold ownership on reuse

bpf: Make post-verification instruction rewrites killable

HID: amd_sfh: Validate PCI BAR size before mapping

bpf: Fix bpf_sock context code generation

s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()

wifi: mac80211: account proxy paths against the mesh path limit

Squid Request Smuggling in HTTP Transfer-Encoding

RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers

libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_decode_ical_string

GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master <file> — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

Out-of-bounds Read in GNU Aspell

Heap Buffer Overflow in GNU Aspell's prezip utility

Integer Truncation Leading to Heap Corruption in GNU Aspell

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

tar filter allows writing outside destination via empty-named symlink

libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay

Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

Windows Network Load Balancing Remote Code Execution Vulnerability

smb: client: flush and commit data before querying allocated ranges

ksmbd: follow SMB2 session expiration semantics

xen/netfront: drop RX packets with a short Ethernet header

Negotiate credentials sent to redirected origin

Authorization: Negotiate sent to foreign origin

cross-origin reuse of a Negotiate connection

auto client cert connection reuse mixup

server-set cookie erases cookie jar

FTP connection reuse inherits client-certificate

Go: CVE-2026-111943 Distrust compromised intermediate certificates in crypto/x509

never-ending loop via server response omission

HSTS cache import drops longer-lived child

redirect to SFTP or SCP bypasses host verification

IMAP APPEND plus CRLF conversion command injection

leaking host credentials to HTTP proxy

wolfSSL public-key pinning bypass

HSTS response erases persisted entries

info leak uploading over WebSockets with GnuTLS

curl_mime_free stack overflow by recursion

server-set cookie aborts cookie jar load

DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments.

Chromium CVE-2026-113291: Memory corruption

Chromium CVE-2026-113290: Use after free

Chromium CVE-2026-113289: Improper input validation

Chromium CVE-2026-113288: Memory corruption

Chromium CVE-2026-113287: Use after free

Chromium CVE-2026-113286: Memory corruption

Chromium CVE-2026-113285: Memory corruption

Chromium CVE-2026-113284: Memory corruption

Chromium CVE-2026-113283: Memory corruption

Chromium CVE-2026-113282: Use after free